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Abstract 

^ — 1 We propose an algorithm that builds and maintains clusters over a network subject to 

^SJ mobility. This algorithm is fully decentralized and makes all the different clusters grow con- 

currently. The algorithm uses circulating tokens that collect data and move according to a 
random walk traversal scheme. Their task consists in (i) creating a cluster with the nodes it 

U discovers and (ii) managing the cluster expansion; all decisions affecting the cluster are taken 
only by a node that owns the token. The size of each cluster is maintained higher than m 
nodes (m is a parameter of the algorithm). The obtained clustering is locally optimal in the 
sense that, with only a local view of each clusters, it computes the largest possible number of 
O clusters (ze the sizes of the clusters are as close to m as possible). This algorithm is designed 

as a decentralized control algorithm for large scale networks and is mobility-adaptive: after a 
I series of topological changes, the algorithm converges to a clustering. This recomputation only 

affects nodes in clusters in which topological changes happened, and in adjacent clusters. 

CO 

0\ 1 Introduction 

CN 

Scalability in distributed system has become a major challenge nowadays, in structuring and man- 
— aging communications. We propose a solution to manage large-scale networks based on the division 

of the system into subsystems, called clusters. We focus in this paper on algorithms that build 
clusters and maintain them after topological reconfiguration. The algorithms we propose are de- 
centralized: all nodes execute the same code. This allows all clusters to be built concurrently, which 
is desirable for efficiency. 

Large-scale networks are often subject to mobility: their components can connect or disconnect. 
This phenomenon has to be taken into account. The algorithm being decentralized also allows the 
algorithm to have no distinguished node, the failure of which would lead to a major re-clustering. 
The connection or disconnection of a node has only a limited impact (that we can state) on the 
algorithm. 

Random walks are naturally adaptive to dynamic networks such as ad-hoc sensors network 
[BBCD02, DSW06_ because they make use only of local up-to-date information. Moreover they can 
easily manage connections and disconnections occurring in the network. 

Our solution takes these different constraints into account. It is based on the circulation of 
several tokens. Each token creates a cluster and coordinates its growing in a decentralized way. 
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A random walk based algorithm is a token circulation algorithm in which a token randomly 
moves among the nodes in the network. A random walk can be used as base of a distributed token 
circulation algorithm. This token collects and disseminates information in the network. At each 
step of the execution of the algorithm, the random walk (the token) is on a node i of the network. 
The node that owns the token chooses one of its neigbour j with a probability l/degree(i). It is 
important to remark that this definition ensures that all nodes, with high probability, eventually 
own the token, and that the token, with high probability, eventually hits all nodes |Lov93| . 

In |BBF04. BBFR06], we introduced and used the combination of a circulating word, i.e. the 
token has a content to collect and broadcast data (this concept is formally defined in Section 2.3 1 
and a random walk as moving scheme of the token. Using this combination, we proposed solutions to 
build adaptive spanning trees for systems like ad-hoc sensor networks. These solutions are tolerant 
to transient failures in the network. 

In these works, we also proposed a fully decentralized solution to the communication deadlock 
problem, introducing a new control mechanism called reloading wave. These works have been used 
to propose a solution to the resource allocation problem in ad-hoc networks [BBFN10J. Such a 
combination has also been used in [BBFR06 to build and maintain spanning structures to solve 
on-the-fly resources research in peer-to-peer grids. 

Although the token perpetually circulates in the network in order to update the underlying 
structure, we bound the size of the circulating word to 2n — 1 in the case of bidirectional commu- 
nication links and to n 2 /4 in the case of unidirectional communication links, by retaining only the 
most recent data necessary to build the tree (with n the size of the network, |Ber06| ). 

We use the content of the circulating word to structure the network into different clusters. Their 
construction and their maintenance are achieved in a decentralized way. Using the properties of 
random walks and of circulating words, the clusters are able to adapt to topological reconfigurations. 
Thus, this solution can be used to design distributed control algorithm on large scale dynamic 
networks. 

Unlike solutions described in |Bas99] IJN06| . our solution does not use any local leader on a 
cluster. The advantage of such solutions is that if a node "moves" in the network, this never entails 
a total reconstruction of the clusters. After a topological change, the system eventually converges 
to a correct global state without having to rebuild all clusters. This kind of approach on a 1-hop 
solution is described in [TIMF05 in which re-clustering mechanism are used. Our solution is totally 
decentralized as opposed to [BBCD02 , in which a spanning structure of the whole network is built 
in a first step, to be divided using a global mechanism. Our solution is realized in a fully concurrent 
way. As stated in [ABCP96J, it considerably accelerates the construction of the different clusters. 
Thus our solution satisfies the property highlighted in |TV08j . 

Moreover, we guarantee that after a topological change, only a bounded portion of the system 
is affected. Nodes that are in clusters that are not adjacent to the one in which it occurs have no 
extra work, and are not even aware of this event. 

In the first section, we present some preliminary notions about random walk based distributed 
algorithms, and we present with more details the clustering problem we solve. The second section 
gives the fundamental distributed clustering algorithm we designed. The third section provides 
proofs about the correctness of the algorithm. The fourth section is about mobility: we present the 
slight adaptations needed to handle nodes and links mobility, as well as proofs of this algorithm: 
we also present a locality result: after topological modifications, in the worst case, the only clusters 
that are affected are the clusters in which the topological changes took place and clusters that are 
adjacent to them. Finally, we conclude this paper by presenting some future works. 
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2 Preliminaries 



In this section, we define a distributed system, a random walk and a circulating word. We also 
introduce the notion of clustering. 

2.1 Distributed system 

A distributed system is a connected graph G = (V,E), where V is a set of nodes with \V\ = n 
and E is the set of bidirectional communication links. A node is constituted of a computing unit 
and a message queue. Two nodes are called neighbors if a communication link exists between 
them. Every node i can distinguish between all its communication links and maintains a set of its 
neighbors (denoted Ni). The degree of i is the number of its neighbors. We consider distributed 
systems in which all nodes have distinct identities. 

We consider asynchronous systems: we do not assume any bound on communication delays and 
on processing times. 

2.2 Random walk 

A random walk is a sequence of nodes visited by a token that starts at i and visits other nodes 
according to the following transition rule: if the token is at i at step t then at step t + 1, it will 
be at one of the neighbors of i, this neighbor being chosen uniformly at random among all of them 
|Lov93llAKL+79] . 

A random walk on a connected graph eventually visits any node with probability 1 (whp in the 
following). It means that, for any finite time t, it is possible that the walk does not hit a given 
node for t steps, but that the probability that it does so tends to as t grows ( |Lov93| ). 

2.3 Circulating word 

A circulating word is a list of data gathered during the circulation of the token in the network. 
In this work, the gathered data is the identifiers of the visited nodes. The word is represented 
as follow: w — <w[l], ...,w[k]> where k is the size of the circulating word and w[l] is the node 
identifier in position / in the word. Each time the token visits a node, the node identifier is added 
at the beginning of the word. 

The token follows a random walk scheme, which allows an efficient management of network. 
The word gathers identifiers of the visited nodes in order to maintain an adaptive spanning tree of 
the network. Only the most recent data is used to build this spanning tree, and, thus, only In — 1 
entries of the word are used. Older data can be removed, which bounds the word length to 2n — 1. 
The detailed procedure to reduce the size of the word is described in |Ber06| (cf. algorithm |2| . 
We use the following procedures: 

• Procedure Size(w : word) : integer - returns the size of the word w; 

• Procedure Nb_Identities(w : word) : integer - returns the number of distinct identities in 
the word w; 

• Procedure Add _Begin(j : identifier, w : word) : word - adds identifier j at the beginning of 
w. 
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The procedure Build _Tree computes from a word w a tree A rooted in w[l]. 
Algorithm 1 Procedure Build _Tree(w : word) : tree 

1: A<—$ 

2: Set_Root(A,w[l]) 

3: for k = 2 to Size(w) do 

4: if w[k] g A then 

5: add_Tree(A, w[k], w[k — 1]) // add as the son of w[k— 1] in A 

6: end if 

7: end for 

8: return A 

The following procedures take a rooted tree as entry (node i executes this procedure): 

• Tree_To_Word(A : tree) : word - computes a word w such that the first identifier of w is 
the root of A; 

• My_Sons(A : tree) : identifiers _set - returns the set of i's sons in A; 

• My _F ather(A : iree) : identifier - returns i's father in A. 

Example 1 Let G — (V, E) with V = {1, . . . , n}. Consider a random-walk based token with word 
w' = <1, 5, 3, 2, 3, 6, 3, 2, 4> corresponding to a token initially generated at node ^ and arriving at 
node 1 after 8 movements. By algorithm^ the tree described m[7](a) is obtained. 

Now, assume that the link 3 — 2 disappears. At this point, the tree is not consistent with the 
network topology. The traversal technique using random-walk based token is used to maintain an 
adaptive communication structure taking into account last collected elements: if after 4 movements 
the word becomes w = <1, 6, 2, 4, 1, 5, 3, 2, 3, 6, 3, 2. 4>. The tree evolves over time, cf. figure [7] 
(b), taking into account the most recent data and then the tree becomes consistent with the network 
topology. 

The idea of the reduction technique is to delete all useless informations in the construction of 
the tree. Then the word reduction of w' is the following reduced word: <1, 6, 2, 4, 1, 5, 3> - we 
obtain the same tree. This reduction is done after each movement of the token using the procedure 
Clean _W or d, cf algorithm^ We prove in \Ber06^ that the size of the circulating word is bounded 
by 2n - 1. 




(a) (b) 

Figure 1: Construction of the tree rooted in node 1. 

The procedure Clean _W ord() removes all successive occurrences of i in the word. It also keeps 
the smallest prefix of the word necessary to represent a sub-tree of the cluster, allowing to bound 
the size of the word. 
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Algorithm 2 Procedure Clean_Word(w : word) : word 

1: 2 i 1 

2: visited < — 

3: while z < Size(w) do 

4: if w[z] = i then 

5: while Size(w) > z + 1 A {(w[z + 1] = to [2]) V (w[z + 1] £ visited A w[z + 1] £ JVi)) do 
6: Delete _Element(w, 2 + 1) 

7: end while 
8: end if 

9: visited < — visited U {w[z + 1]} 
10: 2 « — 2 + 1 
11: end while 
12: return w 



2.4 Clusters 

To allow scalability of random walk-based algorithms, we propose to divide the system into clusters. 
Each cluster is maintained by a token. The size of all clusters is greater than to, that is a parameter 
of the algorithm. Clusters are larger than to nodes and as close to m nodes as possible. In the 
following, we suppose that the system is connected and contains at least to nodes. 

A cluster is represented by a variable col on each node. This variable is the color (identifier) of 
the cluster to which the node belongs. Each cluster has to be connected. 

Definition 1 (Cluster) The cluster of color c, noted V c , is the set of all nodes having the color c 
(if non-empty). 

V c = {i € V, cok = c} 
A non-empty set of nodes V is a cluster if there exists a color c such that V = V c . 

Definition 2 We call a cluster divisible if it can be split into two connected subgraphs of sizes 
greater than m. 

Definition 3 A spanning tree A of a cluster is called divisible if it contains an edge that, when 
removed, leads to two trees of size greater than m. 

Property 1 A divisible cluster admits a divisible spanning tree. 

Proof Let V a divisible cluster. Then, it admits two connected subgraphs V\ and Vi with sizes 
greater than m. V\ (resp. V2) admits a spanning tree Ai (resp. A2). V being connected, consider 
an edge a between a node in V\ and a node in V2. Then, the tree A obtained from Ai and A2 by 
adding the edge a is a spanning tree of V that is divisible (when removing a, we obtain two trees 
of size greater than to) . 

□ 

Inthe algorithm "growing" phase, the clusters grow from an empty set by annexing nodes. Two 
situations must be managed: divisible clusters, and clusters with a size strictly lower than to. 

Definition 4 (Stable cluster) A cluster V c is called stable if it is large enough: 

stable(V c ) = (\V C \ > m) 
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Definition 5 (Free Node) A node is called free if it does not belong to any cluster: 

free(i) = (coli = null) 
Thus, each node in the network either belongs to a cluster or is free. 

2.5 Problem specification 

The aim of this algorithm is to build a clustering. Thus, we want that: 

• all nodes belong to a cluster; 

• clusters are connected. 

Additionally, we require that all clusters have a size greater than m and are not divisible. 

To forbid a trivial clustering consisting in all nodes setting their color to the same color, we add 
an extra constraint: we require that there is no divisible cluster. No clustering algorithm working 
on arbitrary topologies can set both a non-trivial lower and a non-trivial upper bound on the size of 
the clusters. Indeed, consider a lower bound m > 1 and an upper bound M < n on a star graph on 
n nodes. Then, there is at least two clusters (since M < n), and the central node is in a cluster V. 
Then, any node i that is not in V is in a connected cluster, that can only be {i}, which contradicts 
the assumption m > 1. 

Thus, we try to obtain clusters as small as possible with a size greater than m. Due to the 
distributed nature of the problem we consider, this "as small as possible" has to be detected on a 
basis that is local to the cluster: no global view can be used to compute the clusters. This is why 
we translate "as small as possible" in "not divisible" 

Finally, we are willing to compute clusters of size greater than rn that are not divisible. 

3 Algorithm description 

One or several nodes start the algorithm by creating a token. Each token is associated to a cluster 
and circulates perpetually according to a random walk scheme, building and maintaining its own 
cluster. The algorithm execution goes through different phases. At the beginning, a cluster (in fact 
its associated token) sequentially annexes nodes, ie when a token meets a free node, the free node 
joins the cluster: it is the collect mechanism. When a token meets another cluster (maintained by 
another token), two cases can occur: either the token is sent back to its own cluster, or it triggers 
a dissolution mechanism on its own cluster if this cluster has a size below m (i.e. a non-stable 
cluster) . The goal of this mechanism is to delete clusters that cannot reach a size of m by making 
all their nodes free. The third mechanism is the division mechanism: if a cluster grows and becomes 
divisible, then the cluster is divided into two smaller stable clusters. 

The algorithm uses five types of messages: Token, Dissolution, FeedbackDiss, Division and 
FeedbackDiv. Token messages are the main messages of the algorithm. They represent a cluster 
and collect node identifiers during their circulation (algorithms [4] and |5| . The four other types 
of messages are control messages circulating in a cluster built by a token. The dissolution and 
division mechanisms are based on a classical propagation of information with feedback |Seg83| 
ITel94l IBDPV07] over the cluster that has to be dissolved or divided. The dissolution mechanism 
uses Dissolution and FeedbackDiss messages to make all nodes in a cluster free (algorithms [6] and 
[7]). The division mechanism uses Division and FeedbackDiv messages to divide one large cluster 
into two smaller clusters (of size still greater than m) (algorithms [8] and [91 . 
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3.1 Nodes and tokens variables 



A cluster is identified by a color: each node having this color belongs to this cluster. The color of 
a cluster is the identifier of the node that has created this cluster. A cluster is created when a free 
node awakens and creates a token (cf . Algorithm [3]) . 
Each token T contains: 

• coIt- the color (identifier) of the cluster it represents and 

• wt- the set of nodes that belongs to this cluster (this is the circulating word). 

The token gathers identities of the visited nodes as explained in the section above. 

A node i saves the identifier of its cluster, and the identifiers of the nodes belonging to this 
cluster. The local variables of a node having the identifier i are: 

• cole color of the cluster i belongs to; 

• Wi'. circulating word of the last token with the same color as i that has visited i; 

• nbF eedbackDivi: number of FeedbackDiv messages received during the division phase; 

• nbFeedbackDisSi. number of FeedbackDiss messages received during the dissolution phase. 

The last two variables are necessary to the Propagation of Information with Feedback algorithms 
used in the dissolution and division mechanisms. 

The definition domain of coli is: {node identifiers in the network} U {null,— 1}. We assume 
there is no node in the network having the identifier -1. A free node is such that coli = null. 
A locked node is such that coli = — 1. The difference between a free node and a locked node is 
that a free node does not belong to any cluster and can join one, while a locked node belongs to a 
"false" cluster, which forbids the node to join a real one. The locked state is used in the dissolution 
mechanism and it is such that no node will remain locked forever. 



The variable u>i is used to break the symmetry in the dissolution mechanism (cf. section 3.2.1 1 
and avoid reciprocal destructions. It also allows node i to know all identifiers of its cluster. 

3.2 Algorithm 

In the following, all procedures are executed by node i. 
Initially, all nodes are free. 

Algorithm 3 On initialization 



coli < — null 
Wi < — e 

nbF eedbackDivi < — 
nbFeedbackDsSi < — 



3.2.1 Collect Mechanism 

When awakening, a free node creates a token with probability 1/2; otherwise it goes back to sleep 
for a random time. The color of the created token is the identifier of the node that creates the 
token. 
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Algorithm 4 On node i awakening 



1: if coli = null then 
2: Toss a coin 
3: if tail then 

4: coli < i 

5: Wi < <i> 

6: Random choice of j £ Ni, Send Token(coli,Wi) to j 
7: end if 
8: end if 



To describe the various cases of the algorithm [5] we assume that node i receives a red token: 

If i is red or free (Algorithm [5] lines [7] to |23[ ) : First i adds its own identifier at the beginning 
of the circulating word and then cleans this word (Algorithm [5] lines [9] and 10 1. This ensures that 
the circulating word always represents a spanning tree of the whole cluster. 

Second, if the tree represented by the word in the token is divisible, then i launches a division: 
a spanning tree is built from the circulating word and the division is done over this spanning tree 
( algorithm [5] lines 11 to 16 1. Otherwise i joins the cluster and sends the token to one of its neighbor 
chosen uniformly at random (algorithm [5] lines 17 to 23 I 



In the following, more details about the division are given (lines [TT] to 16 1 . The spanning tree 
is partitioned into two sub-trees using the following procedure Divide(A tree) : (wi : word,W2 '■ 
word): 

1 . Ai and A2 are two subtrees of A; 

2. the union of Ai and Ai is A and the intersection of A\ and A2 is empty; 

3. the root of Ai is i; 

4. w\ is a word representing Ai; 

5. W2 is a word representing A2] 

6. Nb_Identities(wi) > m and Nb _I dentities(w2) > rn. 

Such an algorithm can, for example, associate to each node in A the size of the subtree rooted 
in this node. If for a node i, this size k is such that k > m and Nb_identities(A) — k > m, then it 
returns the word computed from the subtree rooted in i and the word computed from the subtree 
obtained by removing i and its descendants from A. If no node verifies this, then the tree is not 
divisible. 



The node i uses the procedure Is_Divisible in order to know if the spanning tree is divisible: 
Procedure I s _Divisible(A tree) : boolean - returns true iff Divide(A) is possible 

If the node i launches a division, then i joins the cluster represented by the word w\. The color 
of this new cluster is i. Then i initiates a propagation of Division messages in the spanning tree 
of the whole cluster (i.e. the tree A). 



If i is locked (Algorithm [5] lines 24 and 25): i sends the token back to its sender 



If i is blue (Algorithm [5] lines 26 to 35): If the size of the cluster represented by T, noted 



(j)T, is too small (|wr| < tu), then the cluster is dissolved in order for the cluster to which i belongs 
to grow. This dissolution is achieved by i launching a dissolution mechanism. However, if the size 
of i's cluster, noted fa, is also too small, then we have to avoid the case when fa is destroyed by a 
node in far and far is destroyed by a node in fa. Thus i can launch a dissolution mechanism over 
6t only if the size of Wi is large enough (m; > to) or if i's color is greater than the one of T (lines 



29 to 31) 



Note that Wi does not contain all node identifiers in fa, but a subset of it. Indeed when the 
token representing <pi, noted t, arrived in i for the last time, i saved wt in Wi. Then all identifiers 
in u>i are identifiers of However, t kept circulating after arriving in i and then some free nodes 
kept joining Thus, some identifiers in <f>i may not belong to uii. 

If i does not launch a dissolution mechanism, then it sends the token back to its sender (line 



33) 
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Algorithm 5 On the reception of Token(colT, u>t) 



1: if (coli = null V coh = coir) then 

2: // Case 1: (i is free) or (i is red and receives a red token) 

3: Wt < — Add_Begin(i,WT) 

4: wt < — Clean _W or d(wr) 

5: if I s _Divisible(wr) then 

6: //If the cluster is large enough, we launch a division 

7: A i — Build _Tree(w T ) 

8: (wi, W2 ) < — Divide(A) // wi = <i, . . . > and W2 = <r2, . . . > 

9: coh < — i 

10: Wi < — wi 

11: Vj G My _ Sons (A) : Send Division(A, wi, W2) to j 

12: else 

13: // Otherwise i joins the cluster and forwards the token 

14: coh < — coir 

15: Wi < — wt 

16: Random choice of j G Ni, Send Token(col T , w T ) to j 

17: end if 

18: else if coh = — 1 then 

19: Send Token(colT ,wt) to wt[1] 

20: // Case 2: i is blue and receives a red token 

21: else 

22: //If the red cluster is too small and under some asymmetric assumptions, i can 
dissolve it 

// Otherwise i sends back the token to its sender 

23: if Nb_Identities(wT) < m A (Nb_Identities(wi) > m V coh > coIt) then 

24: A < — Build _Tree(w T ) 

25: Send Dissolution(A) to w T [l] 

26: else 

27: Send Token(colr ,wt) to wt[1] 

28: end if 

29: end if 



3.2.2 Dissolution mechanism 

The dissolution mechanism is used to totally delete a cluster with a size smaller than m. This 
mechanism is a classical propagation of information with feedback. A Dissolution message is 
propagated through a spanning tree of the cluster to dissolve, and then during the feedback phase, 
a FeedbackDiss message is propagated in the tree. Each of these two kinds of messages has one 
variable, A that is a rooted spanning tree of the cluster that has to be dissolved. Both propagation 
and feedback waves are propagated on the tree A. 

During the propagation phase, a node receiving a Dissolution message leaves its cluster and 
becomes locked. The propagation phase is used to completely delete the cluster. Then during the 
feedback phase, a node receiving a FeedbackDiss message becomes a free node. At the end of a 
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dissolution, all nodes that used to be in the cluster are free, and the cluster does not exist anymore. 



Algorithm 6 On the reception of Dissolution(A) 

1: col i < 1 

2: Wi < E 

3: if \My_Sons{A)\ > then 

4: Vj G My _Sons(A) : Send Dissolution(A) to j 

5: nbFeedbackDisSi < — 

6: else 

7: Send Feedback Diss (A) to My __Father(A) 

8: coli < — null 

9: end if 



Algorithm 7 On the reception of FeedbackDiss(A) 
1: nbFeedbackDisSi + + 

II if i receives the last feedback it was waiting for 

2: if nbFeedbackDisSi = \My _Sons(A)\ then 
3: send FeedbackDiv(A) to My _F other (A) 

4: coli < null 

5: end if 



3.2.3 Division mechanism 

The division mechanism is used to divide a cluster <p into two smaller clusters fa and fa with a size 
greater than to. This mechanism is a Propagation of Information with Feedback (PIF). A Division 
message is propagated in a spanning tree of the cluster to divide, and then during the feedback 
phase, a FeedbackDiss message is propagated through the tree. Each of these two kind of messages 
has three variable: 

• A: a rooted spanning tree of the cluster that has to be dissolved; 

• w%: a rooted spanning tree containing all node identifiers of the first sub-cluster fa; 

• W2'- a rooted spanning tree containing all node identifiers of the first sub-cluster fa. 

Subtrees u>i and W2 are a partition of the tree A. Moreover, the first identifier of u>\ (resp. 
W2) is the root of the sub-tree built by w\ (resp 11)2). The color of the cluster fa (resp fa) is the 
identifier of the root of the trees built by W\ (resp. 102)- The PIF is propagated among the tree A. 

During the propagation phase, a node receiving a Division message checks in which subtree, 
w\ or W2, it belongs to, and joins this cluster accordingly (algorithm|8] lines [2] to [8]). Then the node 
executes the PIF algorithm (algorithm [8j lines [9] to 14 1. When the root of w\ (resp. W2) receives 



the last FeedbackDiv message it is waiting for, the node creates a new token initialized with the 
word W\ (resp. w 2 ) (algorithm [9]). 

The division mechanism is based on a PIF rather than a diffusion, because when a division is 
launched, the token of the cluster disappears. The new tokens are only created during the feedback, 
so that when they are created, they correspond to the existing clusters. 
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Algorithm 8 On the reception of Division{A,w\,W2) 



1: 


if i G wi 


then 


2: 


Wi < — 


Wl 


3: 


cok < — 


- Wl[l] 


4: 


else 




5: 


Wi i — 


W2 


6: 


cok < — 


- w 2 [l] 


7: 


end if 





8: if \My_Sons(A)\ > then 

9: V? G My_Sons(A) : Send Division(A, wi, w 2 ) to j 
10: nbFeedbackDiVi i — 
11: else 

12: Send FeedbackDiv(A,w 1 ,w 2 ) to My _Father(A) 
13: end if 



Algorithm 9 On the reception of FeedbackDiv(A, w\, W2) 

1: nbFeedbackDiVi + + 

II if i receives the last feedback it was waiting for 

2: if (i G w 1 AnbFeedbackDiVi = \My_Sons(wi)\) V (i G w 2 AnbFeedbackDiVi = \My _Sons(w 2 )\) then 

3: if i — wi [1] then 

4: // if i is the root of the first tree 

5: Random choice of j G N i: send Token(i, Wi) to j 

6: else if j = w 2 [l] then 

7: // if i is the root of the second tree 

8: Random choice of j G N t , send Token(i, w 2 ) to j 

9: else 

10: send FeedbackDiv(A, wi,w 2 ) to My _Father(A) 

11: end if 

12: end if 



4 Proof of correctness 

In this section, we prove that starting from an initial configuration, the clustering eventually meets 
the problem specification (see subsection 2.5). 

4.1 Preliminaries 

Assuming G = (V, E) is the communication graph and c a color, we have the following definitions. 

Definition 6 (Graph induced by a cluster) Let V c be a cluster. We note G c the graph induced 
by all the nodes in V c . 

G c = (V c , E c ) with: E c = En(V c x V c ) 
Definition 7 (Cluster neighbors) Let V c be a cluster. The neighborhood ofV c , noted N(V C ), is: 

N(V C ) = {iEV, 3j e V c , j G Ni} U V c 
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Note that V c C N(V C ). 



Definition 8 A configuration 7 is called legitimate iff: 

• each node belongs to exactly one cluster; 

• each cluster is connected; 

• each cluster has a size greater than m; 

• no cluster is divisible; 

• there is exactly one token of color c in N(V C ); 

• there are only Token messages circulating in the network. 

Property 2 A legitimate configuration respects the specification of the problem: 

1. all nodes belong to a cluster; 

2. all clusters are connected; 

3. each cluster has a size greater than m; 
4- no cluster is divisible. 

Definition 9 A configuration is called initial iff: 

• each node is free; 

• there is no message circulating in the network. 

4.2 Correctness proofs 

We show in this section that from the initial configuration the system reaches a legitimate config- 
uration. 

At the initialization, there is no message in the network. Then the only rule a node can execute 
is the algorithm [4j Only free nodes can execute this rule, and its execution makes the node create 
a token with probability | . Thus a node i will eventually execute this rule and will then create a 
token T = Token(i, < i >). 

At this point a cluster Vi is created, and node i takes the color i. T begins to circulate in the 
network. We say that Vi is in its growing phase. Each time T is received by a node, this node (i) 
enters in the cluster writing i in its col variable, adds its id at the beginning of the word wt and 
makes T circulate, or (ii) sends back T to the sender, or (iii) makes the cluster change its phase, 
going from phase growing to the phase division (T disappears and the node sends back a division 
message) or dissolution (T disappears and the node sends back a division message). Thus, during 
the growing phase, the cluster Vi is connected, there is only one token of color i in the network and 
wt is a spanning tree of Vi- 

Lemma 1 Except when being dissolved or divided, clusters are connected. 
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Proof Consider a cluster V c . V c evolves by being created, recruiting new nodes, being dissolved, 
or being split. 

When created, V c — {c} (no other node can have color c, since this would mean that c had 
already created a token, in which case it can only get free again after the dissolution of the cluster). 
V c is connected. 

A new node is recruited to V c when it receives a token with color c, sent by a node that is already 
in V c - indeed, a token with color c can only be sent by a node that is already in V c (algorithm 4 
line 6, algorithm 5 lines 16 and 19, algorithm 9 lines 5 and 8), or by a node neighboring V c that 
sends the token back to its sender (already in V c ). Thus, there is a link between a newly recruited 
node and a node that is already in V c : if V c is connected, it remains so. 

When V c is dissolved, a PIF is launched on one of its spanning trees, at the end of which all 
nodes have left V c : V c is then the empty graph, which is connected. 

When V c is divided, it is divided only when divisible, ie when it can be divided into two 
connected clusters of size greater than m. Then all nodes leave V c and join their new clusters, that 
are connected (one of which may still have color c). 

□ 

Lemma 2 At least one cluster is created whp. 

Proof If there is no cluster in the network, on a free node awakening, a token is created infinitely 
often with probability 1/2: eventually, whp, a token is created. Then this token starts building a 
cluster (cf. Algorithm [4} . 

□ 

Lemma 3 Eventually, a token of color c exists if and only if V c ^ 0. In this case, this token is 
unique and is in N(V C ). 

Proof The only token creation is on a free node executing algorithm [4] The color of this token 
is the id of the free node that creates it. Since, after creating a token, a node has a color, it can 
no longer be free. The only cases when a node becomes free again are in algorithms 6 and 7 (in 
algorithm 8, lines 3 and 6, Wi[l] and ^[l] cannot be null, since the words computed by procedure 
Division are non-empty). To execute algorithms 6 and 7, a node has to have received a message 
Dissolution or a message FeedbackDiss respectively. A Dissolution message can only be sent 
by its father if it has itself received this message (algorithm 6) or by a node in a stable cluster or 
with a higher color, in which case the token of its color has been removed (algorithm 5). Messages 
FeedbackDiss can only be received from a son to which the node has already sent a Dissolution 
message. Anyway, the dissolution procedure is always triggered on a cluster of color i after a token 
of color i has been removed, and it is the only phase when a node can become free. Thus, after a 
node i has created a Token with color i, it can create a new Token only if the previous one has 
been removed. Since it is the only node that can create a token with color i, there is at most one 
token with color i at a time in the network. 

Thus, if a token of color c exists, the node of id c is in V c . And if V c ^ 0, then V c contains c 
and there is a token of color c. 

If a node outside V c receives a Token with color c, it either joins V c (if it is free; algorithm 5, 
line 9), or triggers the removal of this token and the dissolution of V c (algorithm 5, line 25), or 
sends it back to its sender (algorithm 5, line 27). Since the token starts in V c (algorithm 4), the 
token can only be in V c , or on a neighboring node. 
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□ 



Lemma 4 Eventually, one cluster (at least) is stable whp. 

Proof In a given execution of this algorithm, there is a finite number of clusters colors used (at 
most, as many colors as nodes in the system, since the color of a cluster is the ID of the node that 
initiated it). 

Consider c the highest color appearing in an execution. Suppose, for the sake of contradiction, 
that no cluster ever becomes stable. 

Suppose that, in the execution, a cluster with color c is dissolved: then, the dissolution process 
can only have been initiated by a clustered node neighboring V c , on the reception of the token with 
color i (algorithm 5, line 25). It launches the dissolution only if it is in a cluster with a higher color 
than c, which is discarded by the definition of c, or if it is in a stable cluster (line 23). Thus, a 
cluster of color c cannot be dissolved. 

Now, suppose that no cluster with color c is dissolved. Then, the token with color c is never 
removed (see proof of the previous lemma). Thus, the token follows an infinite path. Each time 
the token hits a free node, this node is added to the cluster: \V C \ is incremented, and the node is 
no longer free, and will remain in V c until a division occurs (by assumption, V c is not dissolved in 
the considered execution), which is possible only if the cluster is stable. Now, whp, any unstable 
neighboring cluster is dissolved, when its token reaches a node in V c , for example (which will occur 
whp according to the hitting property of random walks). At this moment, there are free nodes in 
N(V C ). The token with color c following a random walk on nodes that are either free or in V c , it will 
reach such a node whp and recruit it to V c . Since the moves of the different tokens are independent, 
whp, the token will be able to recruit a new node. Once m nodes are recruited, V c is stable, which 
contradicts the assumption. 

Thus, whp, at least one cluster is eventually stable. 

□ 

Lemma 5 A node belonging to a stable cluster remains in a stable cluster. 

Proof Consider a node i belonging to a stable cluster of color c. Since its color is not null, i 
can only change its color in algorithm 5 line 9, algorithms 6 and 7, or algorithm 8, line 3 and 6. 
Algorithms 6 and 7 correspond to a dissolution phase of V c , which is impossible since V c is stable. 
Algorithm 5 line 9, and algorithm 8, are part of the division process, that divides a stable cluster 
into two stable clusters (algorithm 5, line 5: the process is launched only when the tree is splittable 
into two subtrees with sizes greater than m). Thus, the cluster to which i belongs after the division 
is still stable. 

□ 

Lemma 6 A divisible cluster is eventually divided whp. 

Proof Consider a divisible cluster V c , and suppose it is never divided. Since it is stable, its size 
can only increase. Suppose it has reached its maximal size. Then, its token browses N(V C ), and if 
we put apart the steps when the token goes out of V c and is sent back, it follows a random walk 
on V c . The spanning tree of V c is computed according to the last minimal terminal covering path 
of the token: according to [Ald90_, it contains a random spanning tree of V c . Thus, any spanning 
tree of V c is computed whp. Now, at least one spanning tree is divisible (property 1). 
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Thus, whp, the tree computed from the circulating word is eventually divisible, and the cluster 
is divided according to algorithm 5 line 7 to 11. 

□ 

Lemma 7 The number of nodes in stable clusters grows to n whp. 

Proof According to lemma|4j eventually and whp, there exists a stable cluster. Suppose that some 
nodes never belong to a stable cluster, and consider a node i that never belongs to a stable cluster, 
and neighboring a node j in a stable cluster. Such a node exists since the network is connected. 
j remains in a stable cluster according to lemma [5j At some point, and by the assumption above, 
the algorithm stops recruiting new nodes to stable clusters. Then, at some point, stable clusters do 
not evolve any longer: 

• they cannot recruit new nodes; 

• they cannot be dissolved since they are stable; 

• they can no longer be split since they do not grow any more (once all splittable clusters are 
split, which eventually happens — see demonstration of the previous lemma — they can no 
longer be split). 

Note V c the cluster of j. 

There is a random walk browsing N(V C ), and, whp, it will hit i infinitely often. Since i is not in 
a stable cluster, whp it is infinitely often free (indeed, if it is in a cluster, the token in this cluster 
must hit V c infinitely often, and the cluster is dissolved infinitely often, which makes i free). Thus, 
whp i is eventually hit by the token of V c while being free (by independency of the moves of the 
different tokens), and is then recruited to the stable cluster V c , which contradicts the assumption. 

Thus, all nodes eventually belong to a stable cluster. 

□ 

Lemma 8 All clusters eventually have a size greater than m, and are not divisible whp. 

Proof Once all node are in stable clusters, all clusters have a size greater than m by definition. 
Then, according to lemma 6, all divisible clusters are divided whp: eventually none of them is 
divisible. 

□ 

Theorem 1 The algorithm converges to a legitimate state whp. 
Proof This comes from lemmas 1, 7 and 8. 

□ 

Corollary 1 Consider an integer M > 2m. If G is such that all its connected subgraphs of size 
greater than M can be partitioned into two connected subgraphs of size greater than m, then the 
algorithm converges whp to a clustering such that all clusters have a size between m and M — 1 . 

Proof Indeed, in such a graph, all clusters of size greater than M are divisible. 

□ 

For example, on complete graphs or on rings, the algorithm leads to a clustering with clusters 
of sizes between m and 2m — 1. 
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5 Adaptive algorithm 

This algorithm can be made adaptive to mobility. In this section, we call correct configuration 
any configuration that could have arisen from the execution of the algorithm on a static network 
corresponding to the current state of the network. More precisely: 

Definition 10 A configuration is called correct if: 

• each cluster is connected; 

• there is exactly one token of color c in N(V C ); 

• if node i 's color is c ^ null, i is in the word of the token of color c, and only in this word; if 
i is free, then it does not occur in any circulating word; 

• if i is the son of j in the tree of some token, then there is a link G E; 

• no message Delete circulates. 

A correct configuration is not always legitimate, but, without any further topological modifica- 
tions, the previous section proves that from any correct configuration, the system eventually reaches 
a legitimate configuration. 

Mobility can manifest in the following ways: 

• link connection: the configuration remains correct, and nothing has to be done; 

• node connection: since the node that connects is initially free, it does not appear in any 
circulating word and the configuration remains correct; 

• node disconnection: this case is dealt like the disconnection of all adjacent links; 

• link disconnection: 

— if this link is between two clusters (cok ^ colj, cok ^ null, colj ^ null): the link 

can appear neither on Wt co1 . nor on on WT aol . ; we use an acknowledgement message to 
detect the case when a token goes (for instance) from i to j, and a disconnection occurs 
before it is sent back to i, leading to no token remaining in the cluster of i; in this case, 
j deletes the token, and i creates a token with the same content as the one of the deleted 
token; 

— if one of this link extremities (or both) is a free node (cok — null V colj — null): since j 
is free, the link (i,j) could not appear on any circulating word: the configuration is still 
correct; 

— if this link is between two nodes in the same cluster (coli = colj ^ null): 

* if they are not linked by any father-son relationship: the link (i, j) does not appear 
in the token of the cluster of color coli, and the configuration remains correct; 

* if i is the father of j: the connectivity of the tree contained in the token of color 
coli is broken; the configuration is no longer correct, and the different mechanisms 
we have setup so far cannot work correctly: this is the reason why we introduce the 
mechanisms presented in this section, to deal with this case. 
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If j is its father, i deletes the subtree rooted in itself: in other words, it propagates a wave on 
this subtree, that makes all its descendants free. Once i has set itself and all its descendant free, 
the token is no longer correct. When it visits j for the next time, j corrects it by removing the 
subtree rooted in any son it is supposed to have, but to which it is actually not connected. Thus, 
the system reaches a correct configuration. 

To implement this, i must always know which node is its father in the token with the same color 
as it. If j is the father of i in this tree, it means that the last time i owned the token, it transferred 
it to j. Thus, i can remember which node is its father. 

The algorithms below describe this mobility-adaptive distributed algorithm. The disconnection 
of a node is dealt as the disconnection of all its adjacent links. 

The initialization phase is left unmodified, except for the initialization of the variable father. 



Algorithm 10 On initialization 
1: coli < — null 
2: Wi < — e 

3: nbFeedbackDivi < — 
4: nbFeedbackDssi < — 
5: fatheri < — null 
6: version < — 



Algorithm 11 On node i awakening 

1: if coli = null then 

2: Toss a coin 

3: if tail then 

4: coh < — (i, version + +) 

5: Wi i <i> 

6: Random choice of j G Ni, Send Token(coli,u>i) to j 

7: fatheri < — j 

8: end if 

9: end if 



When receiving a token, a node first checks whether it is correct regarding its own neighborhood. 
If it detects an inconsistency between the tree borne by the token and its neighborhood, it modifies 
the tree so that it is in accordance with the (new) topology of the system. 



18 



Algorithm 12 On reception of X 'oken(colT , Wt) 

1: A < — Build _Tree(w T ) 

2: if A contains an edge (j, i) Aj £ N(i) then 

3: // If i is supposed to be j's father, but is not actually connected to it 

4: remove the subtree of A rooted in j 

5: w T < — Tree_To_Word(A) 

6: end if 

7: if (coli = null V coli = coir) then 

8: // Case 1: (i is free) or (i is red and receives a red token) 

9: wt < — Add_Begin(i,WT) 

10: w T < — Clean _W ord(w T ) 

11: if I s _Divisible(wT) then 

12: //If the cluster is large enough, we launch a division 

13: (wi, W2 ) < — Divide(A) // wi = <i, . . . > and W2 = <r2, . . . > 

14: coli < — i 

15: Wi < M)i 

16: Vj G My Sons(A) : Send Division(A, wi, W2) to j 

17: else 

18: // Otherwise i joins the cluster and forwards the token 

19: coli < col T 

20: Wi i — Wt 

21: Random choice of j G Ni, Send Token(colr, wt) to j 

22: fatheri < — j 

23: end if 

24: else if coh = — 1 then 

25: Send Token(colT ,wt) to wt[1] 

26: // Case 2: i is blue and receives a red token 

27: else 

28: //If the red cluster is too small and under some asymmetric assumptions, i can 
dissolve it 

// Otherwise i sends back the token to its sender 

29: if Nb_Identities(wT) < m A (Nb_Identities(wi) > m V coh > coIt) then 

30: A i — Build _Tree(w T ) 

31: Send Dissolution(A) to w T [l] 

32: else 

33: Send Token(colT ,wt) to wt[1] 

34: end if 

35: end if 



When detecting that it can no longer communicate with its father, i initiates a wave on the 
subtree rooted in it. Delete messages are sent to all its neighbors, but only those that consider i 
as their father take it into account. They set themselves free, and send Delete messages to their 
neighbors, until all of i's descendants are free. A node always knows its current father, so that the 
nodes that are set free are the current descendants of i. Thus, the set of nodes that are freed in 
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this process is a subtree of the token's tree, and its complement is itself a subtree. If a freed node is 
visited by the token, then it is recruited, and the tree is modified according to the node to which it 
sends the token. Thus, the set of nodes that are free, but appear in the token, is always a subtree 
of the token's tree, and its complement is always a subtree too. When the token visits i's father, it 
is corrected, and is consistent with the data present on the nodes. 



Algorithm 13 On a disconnection of node j 
1: if j = father i then 
2: coli < — null 
3: fatheri < — null 
4: send Delete to all neighbors 
5: end if 



Algorithm 14 On reception of Delete on node i from a node j 
1: if j = fatheri then 
2: coli < — null 
3: fatheri < — null 
4: send Delete to all neighbors 
5: end if 



If a dissolution occurs on a cluster that has been subject to a disconnection, the Dissolution 
PIF is triggered on the subtree of all nodes that are in the token, and are reachable. The remaining 
of the cluster has already been set free, so that the cluster is eventually dissolved. 



Algorithm 15 On the reception of Dissolution(A) from k 

1: if k = fatheri then 

2: cok < 1 

3: Wi < — e 

4: end if 

5: if \My_Sons{A)\ > then 

6: V? G My _Sons(A) n N(i) : Send Dissolution(A) to j 
7: nbFeedbackDissi < — 

8: else 

9: Send FeedbackDiss(A) to My _Father(A) 
10: coU < — null 
11: fatheri < — null 

12: end if 
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Algorithm 16 On the reception of FeedbackDiss(A) 



1: nbFeedbackDisSi + + 

//Hi receives the last feedback it was waiting for 

2: if nbFeedbackDisSi = \My_Sons(A) (1 N(i)\ then 
3: send FeedbackDiv(A) to My _F other (A) 
4: coU < — null 
5: fatheri < — null 

6: end if 



If a division along an edge (a, 6) occurs in a cluster that has been subject to the disconnection 
of a link three cases can occur: 

1. is lower in the tree than (a, b); 

2. = (a,b); 

3. (i, j) is higher than (a, b). 

In all these cases, the division PIF is propagated through the subtree of all the nodes that are still 
connected through this tree. In the first case, one of the two clusters is correct, and the other is not 
(its token "believes" that some node are in the cluster, while they are not). In the second case, only 
one clusters exists, and it is correct. In the last case, only one cluster exists, and it is not correct 
(the token "believes" that some node are in the cluster, while they are not). 

Algorithm 17 On the reception of Division(A, W\, W2) from k 



1 

2 
3 
4 
5 
6 
7 
8 

9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 



if k = fatheri then 
if z G wi then 

Wi < — Mil 
coU < — ltfl[l] 
else 

Wi i W2 

COli < U)2[l] 

end if 

if I My_ Sons (A)\ > then 

Vj G My _Sons(A) H N(i) : Send Division(A, wi, W2) to j 

nbFeedbackDivi < — 
else 

Send FeedbackDiv(A,u>i, W2) to My_Father(A) 
end if 
else 

if \My_Sons(A)\ > then 

Vj G My_Sons(A) PI N(i) : Send Dissolution(A) to j 

nbFeedbackDisSi < — 
else 

Send FeedbackDiv(A,u>i, W2) to My_Father(A) 
end if 
end if 
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Algorithm 18 On the reception of FeedbackDiv{A,w\,W2) 
1: nbF eedbackDiv i + + 

// if i receives the last feedback it was waiting for 

2: if (i G wiAnbFeedbackDiVi = \My _Sons(wi)C\N(i)\) V(i G u>2 AnbFeedbackDiVi = |My_ Sons (102)0 

iV(i)j) then 
3: if i = Wi [1] then 

4: // if i is the root of the first tree 

5: Random choice of j € JVf , send Token(i, wi) to j 

6: fathert < — j 

7: else if i = W2[l] then 

8: // if i is the root of the second tree 

9: Random choice of j G N t , send Token(i, w 2 ) to j 
10: fatheri < — j 
11: else 

12: send FeedbackDiv(A, Wi, w 2 ) to My _Father(A) 
13: end if 
14: end if 



First we prove that any node has information about its father in the tree borne by the token. 

Lemma 9 If i does not own the token, (i, father i) is an edge of the tree of a token of color coh. 

Proof father i is the last node to which i has sent the token of color coli (algorithm 11, line 7; 
algorithm 12, line 8 and 27; algorithm 18, lines 6 and 10; algorithm 12, line 38 is when i sends back 
a token that is not of its color; algorithm 13 and 14 show that if i has no color anymore, it has no 
father anymore cither). 

The father of i in the tree computed from a word w is the node j such that the first occurrence 
of i in w is preceded by j. Now, the first occurrence of i in w was written in w the last time the 
token visited i. Indeed, no reduction of w can delete the first occurrence of a node. Then, i sent 
the token to a node, that added its id at the beginning of the token, ie just before i's id. This has 
never been removed, since i's id would have been removed too in this case. Thus, the node to which 
i sent the token is j. The father of i in the tree of the token is father i. 

□ 

We now focus on a link disappearing, with fatheri = j, in a cluster of color c. 

Lemma 10 When a link disappears, with fatheri = j, eventually, all descendants of i are 

eventually set free. 

Proof When i detects that it is no longer connected to its father, it sends a Delete message to all 
its neighbors (algorithm 13). When a node receives a Delete message, if it comes from its father, it 
sets itself free, and forwards it to all its neighbors (algorithm 14) . Thus, all descendants of i that 
can be reached through the spanning tree are set free. Now, if a descendant of i cannot be reached 
through the spanning tree, a link in the subtree rooted in i has also disappeared. Thus, a Delete 
wave has triggered on a subtree of the spanning tree, lower than i, that has reached this node and 
set it free. 

□ 
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Figure 2: Descendants of i are set free 



Then, three case can happen: 

• a dissolution of the cluster occurs before the token of color c hits j; 

• a division of the cluster occurs before the token of color c hits j; 

• the token of color c reaches j before a dissolution or a division occurs. 

Basically, when the token of color c hits j, j corrects the token to make it in accordance with the 
disconnection of (i, j). A dissolution also leads to a correct configuration, and a division transfers 
the problem to the new cluster in which the disconnected subtree is included. 

Note that a version number in the token ensures that no two tokens (and thus, no two clusters) 
can have the same color. 

Lemma 11 // the token hits j , the token is corrected. 

Proof On the token hitting j, j executes algorithm 12, lines 4 and 5, which corrects the token. 

□ 

Lemma 12 The dissolution process on a tree A makes all nodes in A free, even in case of a 
disconnection of a link in A with father \ = j, except for nodes that have been recruited to 

other clusters. 

Proof When receiving a Dissolution message a node forwards it to all of its reachable sons, so 
that all reachable nodes in A are hit. Then, it leaves the cluster and gets free. 

Nodes that are not reachable have received Delete messages (see lemma above), and are free, 
unless they have been recruited by another cluster. 

□ 

Lemma 13 After a division process on a tree A along an edge (a, b) with colors c and c 1 , and with 
the disconnection of with f other i = j, nodes that have been recruited to another cluster keep 

their colors; nodes that are in the same connected component as a take the color c; nodes that are 
in the same connected component as b take the color d ; nodes that are disconnected from both a 
and b (due to the loss of are free, unless they have been recruited to another cluster. 
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Figure 3: The dissolution wave when the token hits j 




Figure 4: The dissolution wave 

Proof The division wave is propagated along A minus the subtree rooted in i. All nodes in this 
subtree have set themselves free. 
Three cases occur: 

• (i, j) is lower in A than (a, b): the subtree rooted in i is a subtree of the subtree rooted in b; 

• (hj) = ( a >b): then all nodes in the subtree obtained by removing the subtree rooted in b set 
their color to c; the others are either free or recruited by other clusters; 

• in other cases: all nodes in the subtree obtained by removing the subtree rooted in i set their 
color to c; the others are either free or recruited by other clusters. 

In all of these three cases, at most one cluster is not correct after the division. Other nodes 
have their expected colors, or are free. 

□ 
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Figure 5: The division wave 



Lemma 14 Eventually, a token of color c exists if and only if V c ^ 0. In this case, this token is 
unique and is in N(V C ). 

Proof Suppose a token of color c exists, and is on a node i. Then i either has created it, or has 
received it from a node j. If it has created it, coli = c, and i € V c . Thus, V c ^ 0. If it has received 
it from j, and i is not of the color c, then it sends it back to j (algorithm 12, line 33) or it destroys 
both the token and V c (algorithm 12 line 31). If the link disconnects before j has had the 

time to send it back to i, then i deletes its cluster (since fatheri = j: algorithm 13 and lemma 10) 
and j deletes the token (algorithm 12, lines 25 and 33: j is unable to send back the token, and does 
nothing, so that the token disappears). Thus, i 6 Vc, and j € N(i). In any case, if a token of color 
c exists, then V c ^ 0, and the token is in N(V C ). 

The only token creation is on a free node executing algorithm [4] The color of this token is 
constituted of the id of the free node that creates it, and of a unique version number. Thus, no two 
tokens can have the same color. 

Now, suppose V c ^ 0. Let i e V c . Since i is of color c, it has received a token of color c. Now, 
the only time a token of color c disappears is when a dissolution or a division process is launched: 
in algorithm 12, each time a node receives a Token message, it sends a Token message or triggers 
a division or a dissolution. When a division is launched, all sites in V c change their color (lemma 
13), so that eventually V c = 0. When a dissolution is triggered, all sites in V c are set free (lemma 
12), and eventually V c = 0. 

□ 

Theorem 2 From any configuration obtained from a correct configuration by adding and removing 
some nodes and links, the algorithm converges to a correct configuration whp (and then, to a 
legitimate configuration). 

Proof The addition of a link or a node (that executes its initialization procedure) to a correct 
configuration leads to a correct configuration (see definition of a correct configuration) . 
If a node is removed, then we treat it as if all its adjacent links were removed. 
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So, consider the disconnection of a link If i and j have no father-son relation, nothing 

happens (algorithm 13). Assume j is the father of i. Then i sets itself free and sends a Delete 
message to all its neighbors (algorithm 13). All nodes descending from i in A are free (lemma 10). 

Then one of the three following events happens first: 

• the token hits j; 

• the cluster is dissolved; 

• the cluster is divided. 

If the token hits j, lemma 11 shows that the cluster and its token are corrected. If the cluster is 
dissolved, then all nodes are free (lemma 12) , and this is correct. If the cluster is divided, the new 
cluster that inherited the edge is still incorrect, and the other cluster either does not exist, 

or is correct (lemma 13). In the latter case, the same applies. Then, by induction, either a token 
of j's color eventually visits j, or fs cluster is eventually dissolved whp. Thus, whp, the clusters 
containing j is correct. 

The same applies to all clusters, and when all clusters are correct, then the configuration is 
correct. 

□ 

Theorem 3 Starting from a legitimate configuration, and adding a topological modification, the 
algorithm converges to a correct configuration and the only clusters modified are at worst the cluster 
in which the modification took place, and the adjacent clusters. 

Proof A stable non-divisible cluster can be modified by the algorithm only if a neighboring node 
is free (algorithm 12). 

The starting configuration is a legitimate one, with the addition of a topological modification. 
If this topological modification is the addition of a link, nothing happens. If this is the addition 
of a node, then, this node will be recruited by a cluster (being surrounded by stable clusters, if it 
creates its own cluster, at the first step, its token reaches a stable cluster and its cluster is dissolved), 
and, at worst it will trigger a division. Other clusters are stable and non-divisible, and have no 
neighboring free node : they are not modified. 

Now, consider a link disconnection. If this link was between two nodes without father-son 
relationship, then nothing happens. Thus, let consider the case when a link (i,j) disappears, and i 
is the son of j in cluster V c . Then, i sets all its descendant free (lemma 11). Neighboring clusters 
may recruit them. Nodes in the cluster that are not descendant of i remain in the cluster. At some 
point, the token reaches j and is corrected. If the cluster is still stable, then it goes on. Otherwise, 
its node may be set free by its dissolution. Only nodes in V c may be set free. Indeed, all other 
nodes are in stable clusters, and remain in stable cluster according to lemma [5j Since only nodes 
in V c may be set free, and all other clusters are stable and non-divisible, only clusters that have a 
neighbor in V c can be modified. 

□ 
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6 Conclusion 



The algorithm presented in this paper computes a distributed clustering on arbitrary topologies in 
a totally decentralized way, and tolerates mobility. Most of the distributed clustering algorithms so 
far are based on the election of a leader, called a "clusterhead". Most of them suffer from the fact 
that a single link or node disconnection can entail a complete change of the clustering. Moreover, 
most of them specify the clustering problem as finding disjoint clusters that are star subgraphs. 
The specification we use is more advanced: we build clusters with a size higher than a parameter m, 
and are locally optimal, in the sense that no cluster can be divided into two clusters greater than m 
(no global optimum can be computed for such a problem without a global view of the system, which 
would be in opposition to the distributed nature of the algorithm). The way we handle mobility 
ensures that the only clusters affected by a node or link disconnection are, in the worst case, the 
clusters in which it took place, and the clusters adjacent to it. The reconfiguration is, as far as 
possible, local. Indeed, the loss of the m th node in a cluster needs this cluster to be deleted (to fit 
the \V\ > m constraint), and adjacent clusters to recruit the newly orphan nodes. 

Thus, this algorithm provides a locally optimal clustering, and, in terms of affected nodes, an 
optimal reconfiguration. We now aim at better studying the complexity of this algorithm, both 
on the theoretical level (although we already know that the size of the network has only a weak 
influence on the time to obtain a global clustering, thanks to the concurrent construction of the 
different clusters), and through simulations. 

We are also interested in making this algorithm self-stabilizing, in order to take into account, for 
instance, the possible message losses. Starting from any arbitrary configuration, the values of the 
nodes variables being arbitrary, and arbitrary messages being in transit, the system has to reach 
a clustering meeting the specification. We already worked on a self-stabilizing random walk based 
token circulation QBBF04J), so that we have clues on how to manage failures on the token. We still 
have to use this block to compute a self-stabilizing distributed clustering. 
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